Information Commissioner's Office 


Freedom of Information Act 2000 


Definition document for health bodies in England 
(this will include all NHS trusts, clinical 
commissioning groups and special health 
authorities) 


This guidance is written for the use of health bodies in England. It gives 
examples of the kinds of information the ICO expects you to provide in 
order to meet your commitments under the model publication scheme. 


The ICO expects you to make the information in this definition document 
available unless: 


e you do not hold the information; 

e the information is exempt under one of the Freedom of Information 
Act (FOIA) exemptions or Environmental Information Regulations 
2004 (EIR) exceptions, or its release is prohibited under another 
statute (eg UK GDPR); 

e the information is readily and publicly available from an external 
website. Such information may have been provided either by you or 
on your behalf. You must provide a direct link to that information; 

e the information is archived, out of date or otherwise inaccessible; 
or, 

e it would be impractical or resource-intensive to prepare the material 
for routine release. 


If the information is held by another public authority, you should provide 
details of where to obtain it. 


This guidance is not meant to give an exhaustive or definitive list of 
everything that should be covered by a publication scheme. The legal 
commitment is to the model publication scheme, and you should look to 
provide as much information as possible on a routine basis, which must 
include all information that is required by statute. 


It is recognised that this document covers a wide range of organisations 
which carry out different functions. However, the information you hold will 
fall under the same headings. 


Health Bodies (England) 1 
Version 4.0 
20211029 


Publishing datasets for re-use 


As a public authority, you must publish under your publication scheme 
any dataset you hold that has been requested, together with any updated 
versions, unless you are satisfied that it is not appropriate to do so. So far 
as reasonably practicable, you must publish it in an electronic form that is 
capable of re-use. 


If the dataset or any part of it is a relevant copyright work and you are 
the only owner, you must make it available for re-use under the terms of 
a specified licence. Datasets in which the Crown owns the copyright or the 
database rights are not relevant copyright works. 


The 2018 Section 45 Code of Practice recommends that public authorities 
make datasets available for re-use under the Open Government Licence. 


The term ‘dataset’ is defined in section 11(5) of FOIA. The terms ‘relevant 
copyright work’ and ‘specified licence’ are defined in section 19(8) of 
FOIA. The ICO has published guidance on Datasets (sections 11, 19 and 
45).This explains what is meant by “not appropriate” and “capable of re- 
use”. 


Model publication scheme 


The table below identifies the specific information the ICO expects you to 
publish under each of the seven classes of information set out in the 


model publication scheme. 


Class 1 - Who we are and what we do 
Organisational information, structures, locations and contacts. 
Information in this class should be current information only, unless stated 
otherwise. 

e How we fit into the NHS structure 
Given the nature of the NHS, provide information that explains how you fit 
into either the local or national NHS structure, or both. Provide outline and 
detailed information about your roles and responsibilities. 

e Organisational structure 
Corporate governance information including details of board or governing 
body members and other key personnel. Include an explanation of your 


internal structure and how the structure relates to roles and responsibilities. 
For clinical commissioning groups (CCGs), also include details of the general 
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practices who are members of the CCG. Include details of any charities. 
e Gender pay gap reporting 


Read the Government’s guidance on the gender pay gap reporting to find 
out what information you need to publish. Publish this data annually if you 
have a head count of 250 staff or more. 


e Workforce diversity 


Publish details of the composition of your workforce. Publish this data at 
least annually. 


e Lists of and information relating to key organisations with 
which you work in partnership 


This information needs to be for the purposes of identifying the relationship 
between you and these bodies. 


e Meetings with pharmaceutical companies and other medical 
suppliers 


As a minimum, include the name of the company, the date and, if 
appropriate, the name of the member(s) of staff attending, together with a 
general indication of the category of meeting, for example marketing or 
promotion. The names of staff attending should include any senior managers 
and any medically qualified staff. 


e Senior executives and management board or governing body 
members 


Identify and include the responsibilities and biographical details of those 
making strategic and operational decisions about the provision of your 
services. Only publish biographical details that are not work related in line 
with UK GDPR. 


e Location and contact details for all public-facing departments 


Provide postal and email address of all public-facing departments. If 
possible, provide named contacts including contact phone numbers and 
email addresses. 
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Class 2 - What we spend and how we spend it 


Financial information relating to projected and actual income and 
expenditure, procurement, contracts and financial audit. 


As a minimum, make available financial information for the current and 
previous financial year. Provide this information not only for your 
organisation as a whole but also, where appropriate, for directorates or 
departments as cost units. 


e Financial statements, budgets and variance reports 
In conjunction with annual accounts, provide financial information in 
sufficient detail to allow the public to see where you are spending money or 
planning to spend it and the difference between the two. 
Publish financial information at least annually and, where practical, provide 
half yearly or quarterly financial reports. Include revenue budgets and 
budgets for capital expenditure. 


Provide details of items of expenditure over £25,000, including costs, 
supplier and transaction information (monthly). 


e Financial audit reports 
e Capital programme 


Make information available on major plans for capital expenditure, including 
any public-private partnership contracts. 


e Staff and board members’ allowances and expenses 


Provide details of the allowances and expenses that can be incurred or 
claimed. Include the total of the allowances and expenses paid to individual 
senior staff and management board or governing body members by 
reference to categories. 


Produce these categories in line with your policies, practices and procedures 
and include at least travel, subsistence and accommodation. 


e Staff pay and grading structures 
You can provide this as part of your organisational structure. As a minimum, 


include the details of senior staff salaries in bands of £5,000. For all other 
posts, identify levels of pay by salary range. 


The ‘pay multiple’ — the ratio between the highest paid salary and the 
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median average salary of the whole of your workforce. 


e Funding (including endowment funds and charitable 
donations) 


e TU facility time 


Read the government guidance on reporting trade union facility time to find 
out what information you need to publish. You need to publish this 
information once a year. 


e Procurement and tendering procedures 


Provide details of procedures used for the acquisition of goods and 
services. 


e Details of contracts currently being tendered 
e List and value of contracts awarded 


Publish details of contracts, invitations to tender and procurement 
frameworks that exceed £30,000, for example value of contract, summary 
of contract and identity of parties. 


Class 3 - What our priorities are and how we are doing 


Strategies and plans, performance indicators, audits, inspections and 
reviews. 


Annual report 

Annual business or commissioning plan 

Targets, aims and objectives 

Strategic direction document (five-year plan) 

Performance against targets (KPI), performance framework, 

performance management information, quality improvement 

plans 

e Reports by regulatory organisations, eg Care Quality 
Commission and NHS England 

e Audit reports delivered at board or governing body level 

e Clinical strategy, if applicable 


Include reports on clinical and corporate governance. 


e Service user surveys 
e Data protection impact assessments (in full or summary 
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format) or any other impact assessment (eg health and safety 
impact assessments, equality impact assessments), as 
appropriate and relevant 


Class 4 - How we make decisions 


Decision making processes and records of decisions. 


Make information in this class available for at least the current and previous 
three years. 


e Board papers - agenda, supporting papers and minutes 


Make readily available to the public management board/governing body 
minutes and the minutes of similar meetings, such as board committees, 
where you made decisions about the provision of services as well as 
documents and papers discussed at these meetings. Exclude material that is 
properly considered to be exempt from disclosure. 


e Patient and public engagement strategy 


e Public consultations (for example, concerning closures or 
variations of services) 


Provide details of consultation exercises and access to the consultation 
papers, or information about where to obtain the papers. Include the results 
of consultation exercises. 


e Internal communications guidance and criteria used for 
decision making, ie process systems and key personnel 


Make readily available internal instructions, manuals and guidelines for 
dealing with your business, where access to this information would assist 
public understanding of the way you made decisions. This does not include 
disclosing information that might damage your operation. 


Class 5 - Our policies and procedures 


Current written protocols, policies and procedures for delivering our services 
and responsibilities. 


Include procedures for handling requests for information. 


e Policies and procedures relating to conducting business and 
the provision of services 
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e Policies and procedures relating to human resources including 
recruitment and employment policies 


Include codes of practice, memoranda of understanding and similar 
information. A number of policies, for example equality and diversity and 
health and safety, will cover both the provision of services and the 
employment of staff. Make readily available details of current vacancies, if 
vacancies are advertised as part of recruitment policies. 


Where procedures are developed in combination with other public 
authorities, make these available. 


e Equality and diversity policies 
Include procedures and guidelines relating to equality and diversity. 
e Health and safety 


(If applicable) Clinical research transparency standards and 
research ethics committees’ standard operating procedures 


Pay policy statement 

Standing financial procedures or instructions 

Standing orders 

Customer service and complaints policies and procedures 
Standards for providing services to your customers, including complaints 
procedures. Include those complaints procedures covering requests for 


information and operating the publication scheme. 


e Data protection and duty of confidentiality, records 
management, Caldicott Guardian 


Include information security policies, high level file plans (or any other 
business classification scheme used for the management of information), 
records retention, destruction and archive policies, data protection 
(including data sharing and CCTV usage), patient confidentiality policies 
and details of the national opt-out programme. 


e Estate management 
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e Charging regimes and policies 


Provide details of any statutory charging regimes. As part of your charging 
policies, include charges made for information routinely published and state 
clearly what costs you are recovering, the basis on which you make them 
and how you calculate them. 


If you charge a fee for licensing the re-use of datasets, state in your guide 
to information how this is calculated and whether the charge is made under 
the Re-use Fees Regulations or under other legislation. you cannot charge 
a re-use fee if you make the datasets available for re-use under the Open 
Government Licence. 


Class 6 - Lists and registers 


Include information contained only in currently maintained lists and 
registers. 


Any information you are currently legally required to hold in 
publicly available registers 


List of main contractors or suppliers 
e Asset registers 
You do not have to publish all details from all asset registers. However, 
make available the location of public land and building assets and key 
attribute information that is normally recorded on an asset register, along 
with some other information from capital asset registers. 


e Information asset register 


If you have prepared an information asset register for the Re-use of Public 
Sector Information Regulations 2015, publish the contents. 


e CCTV 


Provide details of the locations of any overt CCTV surveillance cameras 
operated by or on your behalf. You should decide on the level of detail 
which is appropriate. This could be by building or more general geographic 
locations, such as postcodes or partial postcodes, depending on the 
security issues raised. 


e Any register of interests kept in the authority 
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e Register of gifts and hospitality provided to board members 
and senior personnel 


e Disclosure log 
Where you have produced a disclosure log, indicating the information that 
has been provided in response to FOIA and EIR requests, make this readily 
available as a matter of good practice. 
Class 7 -— The services we offer 
Information about the services we offer, including leaflets, guidance and 


newsletters. 


In general, this will be an extension of the first class of information, ‘Who 
we are and what we do’, as it will detail the services that you provide. The 
starting point would normally be a list or lists of the services that fall within 
your responsibility, linked to details of those services. 

Clinical services provided or commissioned 

Non-clinical services 


Services for which you are entitled to recover a fee 
together with those fees 


Patient support groups, including bereavement support 


Patient information leaflets and other booklets and 
newsletters 


Patient advice and liaison service (PALS) 


Advice and guidance 


Corporate communications and media releases 
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